local-operator-ui 0.34.11 → 0.34.12

package/out/main/index.js

@@ -4484,6 +4484,9 @@ const SHIPIT_RELATIVE_PATH = path$1.join(
 const INSTALLER_TOKEN = "local-operator-update-installer";
 const UPDATE_STAGING_DIR = "update-staging";
 const INSTALLER_POLL_SECONDS = "0.2";
+const INSTALLER_FIRST_GRACE_SECONDS = 60;
+const INSTALLER_SECOND_GRACE_SECONDS = 20;
+const INSTALLER_KILL_SETTLE_SECONDS = "0.5";
 const EXTRACTION_TIMEOUT_MS = 10 * 6e4;
 function shipItPathInBundle(bundlePath) {
   if (!bundlePath) return null;
@@ -4563,6 +4566,8 @@ function shipItStatePlist(input) {
   };
 }
 function buildInstallerSpawn(input) {
+  const firstGrace = input.graceSeconds?.first ?? INSTALLER_FIRST_GRACE_SECONDS;
+  const secondGrace = input.graceSeconds?.second ?? INSTALLER_SECOND_GRACE_SECONDS;
   const script = `#!/bin/sh
 # ${INSTALLER_TOKEN}
 #
@@ -4573,10 +4578,74 @@ function buildInstallerSpawn(input) {
 # (SQRLInstallerErrorDomain Code=-9, the 2026-09-18 09:37 install). So this waits
 # for the app's pid to go, and then replaces itself with the installer: one
 # process, one pid for the app to record, and no shell left in the way.
-while kill -0 "$1" 2>/dev/null; do
+#
+# THE WAIT IS BOUNDED AND LOGGED (2026-10-11): the unbounded shape waited 26 m
+# 49 s while the app sat alive with no window, and logged nothing anywhere. Each
+# stage below is bounded and writes one timestamped line to the installer's log;
+# the last stage starts the installer regardless, because a pid that survives
+# SIGKILL is a zombie and nothing more exists to wait for.
+app_pid=$1
+started=$(date +%s)
+log_stage() {
+	printf '%s ${INSTALLER_TOKEN}: %s\\n' "$(date '+%Y-%m-%dT%H:%M:%S')" "$1" >>"$LO_UPDATE_INSTALLER_LOG"
+}
+elapsed() {
+	printf '%d' "$(( $(date +%s) - started ))"
+}
+# A recycled pid is never signalled: before any kill, the target's command line
+# must still name the app's own executable ($LO_UPDATE_INSTALLER_APP_EXEC,
+# environment only - see the args comment at the callers).
+target_is_app() {
+	[ -n "$LO_UPDATE_INSTALLER_APP_EXEC" ] || return 1
+	_line=$(ps -o command= -p "$app_pid" 2>/dev/null) || return 1
+	case "$_line" in
+		*"$LO_UPDATE_INSTALLER_APP_EXEC"*) return 0 ;;
+	esac
+	return 1
+}
+start_installer() {
+	log_stage "starting the installer ($(elapsed)s in)"
+	exec "$LO_UPDATE_INSTALLER_SHIPIT" "$LO_UPDATE_INSTALLER_LABEL" "$LO_UPDATE_INSTALLER_STATE" >>"$LO_UPDATE_INSTALLER_LOG" 2>&1
+}
+log_stage "waiting up to ${firstGrace}s for the app to exit on its own"
+_end=$((started + ${firstGrace}))
+while kill -0 "$app_pid" 2>/dev/null; do
+	if [ "$(date +%s)" -ge "$_end" ]; then break; fi
 	sleep ${INSTALLER_POLL_SECONDS}
 done
-exec "$LO_UPDATE_INSTALLER_SHIPIT" "$LO_UPDATE_INSTALLER_LABEL" "$LO_UPDATE_INSTALLER_STATE" >>"$LO_UPDATE_INSTALLER_LOG" 2>&1
+if ! kill -0 "$app_pid" 2>/dev/null; then
+	log_stage "the app exited on its own ($(elapsed)s in)"
+	start_installer
+fi
+log_stage "the first grace expired with the app still there"
+if target_is_app; then
+	log_stage "asking the app to stop (SIGTERM)"
+	kill -TERM "$app_pid" 2>/dev/null
+	_end=$(( $(date +%s) + ${secondGrace} ))
+	while kill -0 "$app_pid" 2>/dev/null; do
+		if [ "$(date +%s)" -ge "$_end" ]; then break; fi
+		sleep ${INSTALLER_POLL_SECONDS}
+	done
+	if ! kill -0 "$app_pid" 2>/dev/null; then
+		log_stage "the app exited after SIGTERM ($(elapsed)s in)"
+		start_installer
+	fi
+	if target_is_app; then
+		log_stage "the second grace expired; forcing the pid gone (SIGKILL)"
+		kill -KILL "$app_pid" 2>/dev/null
+		sleep ${INSTALLER_KILL_SETTLE_SECONDS}
+		if kill -0 "$app_pid" 2>/dev/null; then
+			log_stage "the pid survived SIGKILL (a zombie or unkillable); nothing left to wait for"
+		else
+			log_stage "the app is gone after SIGKILL ($(elapsed)s in)"
+		fi
+	else
+		log_stage "target is not the app after SIGTERM; starting the installer"
+	fi
+	start_installer
+fi
+log_stage "target is not the app; starting the installer without signalling"
+start_installer
 `;
   return {
     script,
@@ -4584,7 +4653,8 @@ exec "$LO_UPDATE_INSTALLER_SHIPIT" "$LO_UPDATE_INSTALLER_LABEL" "$LO_UPDATE_INST
       LO_UPDATE_INSTALLER_SHIPIT: input.shipItPath,
       LO_UPDATE_INSTALLER_LABEL: input.label,
       LO_UPDATE_INSTALLER_STATE: input.statePath,
-      LO_UPDATE_INSTALLER_LOG: input.logPath
+      LO_UPDATE_INSTALLER_LOG: input.logPath,
+      LO_UPDATE_INSTALLER_APP_EXEC: input.appExecPath
     },
     // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the
     // script text carries no path and no number that a process listing of it
@@ -4611,6 +4681,8 @@ const INSTALL_DISK_SLACK_BYTES = 256 * 1024 * 1024;
 const DOWNLOAD_PAGE_URL = "https://local-operator.com/download";
 const WATCHDOG_TIMEOUT_SECONDS = 600;
 const WATCHDOG_HARD_TIMEOUT_SECONDS = 1800;
+const WATCHDOG_APP_WAIT_NOTICE_SECONDS = 15;
+const WATCHDOG_APP_WAIT_FALLBACK_SECONDS = 2 * (INSTALLER_FIRST_GRACE_SECONDS + INSTALLER_SECOND_GRACE_SECONDS);
 const PENDING_INSTALL_RECENCY_MARGIN_SECONDS = 300;
 const PENDING_INSTALL_RECENCY_SECONDS = WATCHDOG_HARD_TIMEOUT_SECONDS + PENDING_INSTALL_RECENCY_MARGIN_SECONDS;
 const LAUNCH_HOLD_END_MARGIN_SECONDS = 60;
@@ -5346,13 +5418,15 @@ function watchdogSignals(platform) {
   return { jobProbe: "launchctl", plistReader: "/usr/bin/plutil" };
 }
 function buildWatchdogPlan(input) {
-  const signals = input.signals ?? watchdogSignals(input.platform);
+  const signals = input.signals ?? watchdogSignals(input.platform ?? "darwin");
   const timeoutSeconds = input.timeoutSeconds ?? WATCHDOG_TIMEOUT_SECONDS;
   const hardTimeoutSeconds = input.hardTimeoutSeconds ?? WATCHDOG_HARD_TIMEOUT_SECONDS;
   const intervalSeconds = input.intervalSeconds ?? 3;
   const settleSeconds = input.settleSeconds ?? 5;
   const appearSeconds = input.appearSeconds ?? 30;
   const announceSeconds = input.announceSeconds ?? 5;
+  const appWaitNoticeSeconds = input.appWaitNoticeSeconds ?? WATCHDOG_APP_WAIT_NOTICE_SECONDS;
+  const appWaitFallbackSeconds = input.appWaitFallbackSeconds ?? WATCHDOG_APP_WAIT_FALLBACK_SECONDS;
   const plistTimeoutSeconds = input.plistReadTimeoutSeconds ?? PLIST_READ_TIMEOUT_SECONDS;
   const script = `#!/bin/sh
 # ${WATCHDOG_TOKEN}
@@ -5450,6 +5524,27 @@ if [ -z "$APP_PID" ] || [ -z "$BUNDLE" ]; then
 fi
 now() { date +%s; }
 app_running() { kill -0 "$APP_PID" 2>/dev/null; }
+# THE WAIT'S OWN CLOCK (2026-10-11). The script is spawned as the quit begins, so
+# its own start IS the wait's start - elapsed is measured from here rather than
+# from the marker's startedAt, which is written before the quit and would need a
+# new seam through two collaborators for a difference of seconds.
+started=$(now)
+# "waiting 15 s" / "waiting 2 min 30 s": elapsed in the units a person reads,
+# with the seconds term dropped at an exact minute ("waiting 30 min") - "30 min
+# 0 s" reads like a clock fault rather than a wait (round-1 D2).
+elapsed_text() {
+	_seconds=$(( $(now) - started ))
+	if [ "$_seconds" -lt 0 ]; then _seconds=0; fi
+	if [ "$_seconds" -ge 60 ]; then
+		if [ $((_seconds % 60)) -eq 0 ]; then
+			printf '%d min' "$((_seconds / 60))"
+		else
+			printf '%d min %d s' "$((_seconds / 60))" "$((_seconds % 60))"
+		fi
+	else
+		printf '%d s' "$_seconds"
+	fi
+}
 # Whether ANY process is this install's ShipIt, for the pid that stopped being it.
 #
 # The same two facts installerElsewhere requires of a line in its listing: this
@@ -5676,8 +5771,31 @@ decided() {
 deadline=$(( $(now) + ${timeoutSeconds} ))
 hard_deadline=$(( $(now) + ${hardTimeoutSeconds} ))
 # 1. The install only starts once the old app has exited.
+#
+#    AND THE WAIT SPEAKS, INSTEAD OF LEAVING THE PERSON IN SILENCE (2026-10-11).
+#    The incident's app sat alive with no window for 26 m 49 s; this script was
+#    the only process left that could say anything, and its first step was
+#    silent until the soft bound - the person watched nothing happen and
+#    resolved it by hand ('kill -TERM', which is what let ShipIt exec). So the
+#    wait now says what it is waiting for and for how long, well before the
+#    installer's own escalation signals the app
+#    (WATCHDOG_APP_WAIT_NOTICE_SECONDS), and after the escalation has
+#    provably failed it hands over the action that works
+#    (WATCHDOG_APP_WAIT_FALLBACK_SECONDS). Each fires at most once; the
+#    kill switch silences both like every other notice (notify's own guard).
+app_wait_notice=0
+app_wait_fallback=0
 while app_running; do
 	if [ "$(now)" -ge "$deadline" ]; then break; fi
+	_waited=$(( $(now) - started ))
+	if [ "$app_wait_notice" -eq 0 ] && [ "$_waited" -ge ${appWaitNoticeSeconds} ]; then
+		app_wait_notice=1
+		notify "Waiting for Local Operator to close so the update can install (waiting $(elapsed_text)). No action is needed yet."
+	fi
+	if [ "$app_wait_fallback" -eq 0 ] && [ "$_waited" -ge ${appWaitFallbackSeconds} ]; then
+		app_wait_fallback=1
+		notify "The update is still waiting for Local Operator to close (waiting $(elapsed_text)). If nothing happens, quit Local Operator (Force Quit if it does not respond) and leave it closed until it opens again by itself."
+	fi
 	sleep ${intervalSeconds}
 done
 # 1b. The app is gone and an install is at work, so the window that just
@@ -5752,7 +5870,16 @@ while :; do
 	if [ "$(now)" -ge "$deadline" ]; then
 		if [ "$signal_known" -eq 1 ] && install_live; then
 			holding=1
-			notify "The update is still installing. Keep Local Operator closed; it will open again when the install finishes."
+			# THE SOFT BOUND BRANCHES TOO (round-1 UX U4): it fires while the app
+			# may still be RUNNING, where "keep it closed" describes a state the
+			# person is not in. App running -> the wait/fallback copy with a fresh
+			# elapsed reading; app gone -> the stay-closed copy, which is true there
+			# (an install this app spawned is live and the swap still needs quiet).
+			if app_running; then
+				notify "The update is still waiting for Local Operator to close (waiting $(elapsed_text)). If nothing happens, quit Local Operator (Force Quit if it does not respond) and leave it closed until it opens again by itself."
+			else
+				notify "The update is still installing. Keep Local Operator closed; it will open again when the install finishes."
+			fi
 		fi
 		break
 	fi
@@ -5780,7 +5907,20 @@ if [ "$holding" -eq 1 ]; then
 	while :; do
 		if decided; then break; fi
 		if [ "$(now)" -ge "$hard_deadline" ]; then
-			notify "The update is taking longer than expected. Local Operator is opening again so you are not left without it — if it says the update is still installing, quit it and leave it closed until the install finishes."
+			# TRUTHFUL ON BOTH ARMS (2026-10-11). The notice that used to stand
+			# here promised "Local Operator is opening again" unconditionally, and
+			# the path below with the app STILL RUNNING ('if app_running; then
+			# exit 0') is exactly where that promise is false - the watchdog
+			# exits without launching, because launching into a running app is
+			# what aborts a swap. So the app-still-running arm now says the true
+			# thing and hands over the action that resolves it, the same fallback
+			# the wait's own notices use; the app-gone arm keeps the notice the
+			# panel's copy expects (UX U10).
+			if app_running; then
+				notify "The update is still waiting for Local Operator to close (waiting $(elapsed_text)). If nothing happens, quit Local Operator (Force Quit if it does not respond) and leave it closed until it opens again by itself."
+			else
+				notify "The update is taking longer than expected. Local Operator is opening again so you are not left without it — if it says the update is still installing, quit it and leave it closed until the install finishes."
+			fi
 			break
 		fi
 		sleep ${intervalSeconds}
@@ -35442,6 +35582,32 @@ function rememberPickedDirectory(kind, filePaths, directoryPicked = false) {
   if (!first) return;
   lastPickedDirectory.set(kind, directoryPicked ? first : path$1.dirname(first));
 }
+const QUIT_EXIT_DEADLINE_MARGIN_MS = 5e3;
+function quitExitDeadlineMs(input) {
+  return SESSION_COOKIE_QUIT_BUDGET_MS + input.quitCleanupFailsafeMs + QUIT_EXIT_DEADLINE_MARGIN_MS;
+}
+function createQuitExitDeadline(input) {
+  let timer = null;
+  let stage = "";
+  return {
+    arm(next) {
+      if (timer) return;
+      stage = next;
+      timer = setTimeout(() => {
+        timer = null;
+        input.onFire(stage);
+      }, input.timeoutMs);
+      timer.unref();
+    },
+    phase(next) {
+      stage = next;
+    },
+    release() {
+      if (timer) clearTimeout(timer);
+      timer = null;
+    }
+  };
+}
 function createQuitState() {
   let quitting = false;
   return {
@@ -36440,6 +36606,9 @@ const GLOBAL_UPDATE_TIMEOUT_MS = 15 * 60 * 1e3;
 const SOURCE_REBUILD_TIMEOUT_MS = 30 * 60 * 1e3;
 const UPDATE_RESTART_STOP_GRACE_MS = 5e3;
 const BUNDLE_ID_REGEX = /^[\w.-]+$/;
+const APP_UPDATE_CACHE_DIR_NAME_REGEX = /^updaterCacheDirName:[ \t]*(\S+)[ \t]*$/m;
+const CACHE_DIR_NAME_OK_REGEX = /^[A-Za-z0-9._-]+$/;
+const UPDATER_CACHE_PENDING_FILE_REGEX = /\.zip$/i;
 const INSTALL_IN_FLIGHT_RECHECK_MS = 1e4;
 const LAUNCHCTL_NOT_LOADED_REGEX = /could not find|no such process/i;
 const APP_OWNED_PUBLISH_HEADROOM_BYTES = 450 * 1024 * 1024;
@@ -37446,6 +37615,7 @@ class UpdateService {
         );
         this.reapWatchdog(outcome.marker, true);
         this.reapStagedUpdateTrees();
+        this.reapUpdaterCache();
         clearPendingInstallMarker(this.markerDir());
         this.retireSupersededInstallRecord();
         this.pendingInstallSucceeded = {
@@ -37460,6 +37630,7 @@ class UpdateService {
         );
         this.reapWatchdog(outcome.marker, true);
         this.reapStagedUpdateTrees();
+        this.reapUpdaterCache();
         clearPendingInstallMarker(this.markerDir());
         this.retireSupersededInstallRecord();
         return;
@@ -37512,6 +37683,7 @@ class UpdateService {
         this.reapWatchdog(outcome.marker, false);
         this.reapFailedInstallLeftovers();
         this.reapStagedUpdateTrees();
+        this.reapUpdaterCache();
         this.schedulePendingInstallFailureDelivery();
       }
     }
@@ -38643,6 +38815,16 @@ ${heal.removed.join("\n")}`,
   startInstaller(handoff) {
     const plan = buildInstallerSpawn({
       appPid: process.pid,
+      /*
+       * The path the spawner's identity check matches before it signals
+       * anything: this process's own executable. `process.execPath` is
+       * `/Applications/Local Operator.app/Contents/MacOS/Local Operator`
+       * in the packaged app, and the running main process's command line
+       * starts with exactly that path - which is the question
+       * `ps -o command= -p <pid>` answers. It travels in the environment,
+       * never in the script text (see the callee's own note).
+       */
+      appExecPath: process.execPath,
       shipItPath: handoff.shipItPath,
       label: handoff.label,
       statePath: handoff.statePath,
@@ -38728,6 +38910,146 @@ ${heal.removed.join("\n")}`,
       }
     }
   }
+  /**
+   * The updater's own cache directory for this app, or null when it cannot be
+   * resolved.
+   *
+   * WHY THE APP NEEDS THIS PATH AT ALL (2026-10-11 cache hygiene): nothing ever
+   * clears `~/Library/Caches/<updater cache dir>/` - measured residue after one
+   * successful install: `update.zip` (~180 MB), `pending/<artifact>.zip` (~180
+   * MB, the SAME bytes) and `pending/update-info.json`, all three left behind by
+   * a download that has already been used or replaced. electron-updater clears
+   * `pending/` on a failed DOWNLOAD and never clears `update.zip` - by design,
+   * because `update.zip` is the differential base its next download patches
+   * against (`MacUpdater`'s `canDifferentialDownload`), so deleting it buys disk
+   * at the cost of a full ~180 MB re-download. `reapUpdaterCache` below is the
+   * bounded-retention answer; this resolver is how it finds the directory.
+   *
+   * TWO SOURCES, in order. The download helper is authoritative for a download
+   * THIS run performed (the same private surface `ensureStagedArtifactVerified`
+   * already reads). It does not survive a restart, and the reap runs at
+   * start-up, so the fallback reads the name electron-updater itself would
+   * read: `updaterCacheDirName` from `app-update.yml` beside the packaged app,
+   * under the base cache path its own adapter computes (`~/Library/Caches` on
+   * macOS). ONE key on ONE line is parsed rather than adding a YAML dependency
+   * on a package that is a transitive dependency of the updater rather than
+   * ours.
+   *
+   * A DELETION ROOT IS NEVER TAKEN FROM THE MARKER or any other mutable record:
+   * a corrupted record would then choose what gets deleted. Null means
+   * "declined to reap", never a guess.
+   */
+  updaterCacheRoot() {
+    const helper = this.downloadHelper();
+    if (helper?.cacheDirForPendingUpdate) {
+      return path$1.dirname(helper.cacheDirForPendingUpdate);
+    }
+    try {
+      const config = fs.readFileSync(
+        path$1.join(process.resourcesPath, "app-update.yml"),
+        "utf8"
+      );
+      const name = config.match(APP_UPDATE_CACHE_DIR_NAME_REGEX)?.[1];
+      if (!name || !CACHE_DIR_NAME_OK_REGEX.test(name)) return null;
+      return path$1.join(electron.app.getPath("home"), "Library", "Caches", name);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Reduce the updater's cache to at most ONE artifact's worth, once an install
+   * is settled (2026-10-11).
+   *
+   * THE RETENTION RULE, and its reasoning. After every settled verdict the cache
+   * is DEDUPED, not emptied: `update.zip` and `pending/<artifact>.zip` are the
+   * same bytes, and only one of them has future value - `update.zip`, the
+   * differential base the next download patches against (`MacUpdater` copies
+   * every download to it, and falls back to a FULL download without it). So:
+   * when `update.zip` exists, the pending artifact and the `update-info.json`
+   * that describes it go (the bytes survive in the base), and when it does not,
+   * nothing is deleted - there is nothing to dedupe, and the pending artifact is
+   * the only copy. The retention window is bounded by the next download, which
+   * overwrites the base in place; there is deliberately NO day-count constant,
+   * because a clock cannot tell a live delta base from a dead one and would
+   * either delete the base the next update needs or count forever on an idle
+   * machine. ROLLBACK STORY: nothing here is a rollback artifact - `update.zip`
+   * cannot be installed by itself, and the app's reinstall and recovery paths
+   * re-fetch from the feed; the retained copy exists for the next update's
+   * DELTA (worth ~180 MB of transfer), not for restoring anything older.
+   *
+   * SAFETY RAILS, re-asked at the point of deletion rather than trusted from the
+   * caller: the three branches that call this have already decided the install
+   * is not in flight, but the machine is asked ONCE more - a live marker, a
+   * running installer, or a relaunch watchdog that is still OURS all mean
+   * something else may still be reading this cache, and the reap stands down
+   * with a log line. A registered-but-idle ShipIt job is NOT one of those
+   * signals (the 0.17.0 lessons: the job outlives finished installs by design),
+   * and the in-flight branch above NEVER calls here.
+   */
+  reapUpdaterCache() {
+    const note = (message) => logger.info(message, LogFileType.UPDATE_SERVICE);
+    const marker = readPendingInstallMarker(this.markerDir());
+    const liveness = this.installLiveness(marker);
+    if (liveness.installerRunning || marker !== null && isInstallInFlight({
+      marker,
+      jobState: liveness.jobState,
+      installerRunning: liveness.installerRunning
+    })) {
+      note(
+        "Not reaping the updater cache: the machine still reports an install in flight."
+      );
+      return;
+    }
+    const watchdogPid = marker?.watchdogPid ?? null;
+    if (watchdogPid != null) {
+      const commandLine = readCommandOutput("/bin/ps", [
+        "-o",
+        "command=",
+        "-p",
+        String(watchdogPid)
+      ]);
+      if (watchdogIsOurs({
+        alive: commandLine != null,
+        commandLine,
+        installSucceeded: true
+      })) {
+        note(
+          `Not reaping the updater cache while relaunch watchdog ${watchdogPid} is still running.`
+        );
+        return;
+      }
+    }
+    const root = this.updaterCacheRoot();
+    if (!root) {
+      note("Updater cache not reaped: its directory could not be resolved.");
+      return;
+    }
+    const base = path$1.join(root, "update.zip");
+    if (!fs.existsSync(base)) {
+      note(
+        "Updater cache left alone: no differential base to dedupe the pending artifact against."
+      );
+      return;
+    }
+    const pendingDir = path$1.join(root, "pending");
+    if (!fs.existsSync(pendingDir)) return;
+    for (const entry of fs.readdirSync(pendingDir)) {
+      if (!UPDATER_CACHE_PENDING_FILE_REGEX.test(entry) && entry !== "update-info.json")
+        continue;
+      const target2 = path$1.join(pendingDir, entry);
+      try {
+        fs.rmSync(target2, { force: true });
+        note(
+          `Reaped the updater cache's duplicate of the differential base: ${target2}.`
+        );
+      } catch (error) {
+        logger.warn(
+          `Could not reap ${target2}: ${String(error)}`,
+          LogFileType.UPDATE_SERVICE
+        );
+      }
+    }
+  }
   /**
    * Both of the machine's liveness answers for this marker.
    *
@@ -43859,6 +44181,7 @@ const backendInstaller = new BackendInstaller({
   // (`./relaunch-pending` owns why scheduling happens only at the terminal).
   onQuitCancelled: () => {
     quitState.cancel();
+    quitExitDeadline.release();
     relaunchPending.clear();
   }
 });
@@ -44178,6 +44501,22 @@ electron.app.whenReady().then(async () => {
       process.on(signal, () => endHeadlessRun(`received ${signal}`));
     }
   }
+  if (windowLaunch.mode !== "headless") {
+    const onSigtermDuringQuit = () => {
+      if (!quitState.isQuitting()) {
+        process.removeListener("SIGTERM", onSigtermDuringQuit);
+        process.kill(process.pid, "SIGTERM");
+        return;
+      }
+      logger.info(
+        "Received SIGTERM during a quit; exiting so the quit reaches its terminal (an update installer may be waiting on this pid).",
+        LogFileType.BACKEND
+      );
+      scheduleReopenAtQuitTerminal();
+      electron.app.exit(0);
+    };
+    process.on("SIGTERM", onSigtermDuringQuit);
+  }
   electron.app.on("browser-window-created", (_, window) => {
     utils.optimizer.watchWindowShortcuts(window);
   });
@@ -45184,7 +45523,22 @@ const scheduleReopenAtQuitTerminal = () => {
     }
   });
 };
+const QUIT_EXIT_DEADLINE_MS = quitExitDeadlineMs({
+  quitCleanupFailsafeMs: QUIT_CLEANUP_FAILSAFE_MS
+});
+const quitExitDeadline = createQuitExitDeadline({
+  timeoutMs: QUIT_EXIT_DEADLINE_MS,
+  onFire: (firedInStage) => {
+    logger.error(
+      `The quit did not finish within ${QUIT_EXIT_DEADLINE_MS} ms (stalled ${firedInStage}); exiting with failure so the process cannot sit alive with no window`,
+      LogFileType.BACKEND
+    );
+    scheduleReopenAtQuitTerminal();
+    electron.app.exit(1);
+  }
+});
 electron.app.on("will-quit", (event) => {
+  quitExitDeadline.phase("will-quit");
   viewerEndpoint?.close();
   viewerRecord?.stop();
   scheduleReopenAtQuitTerminal();
@@ -45224,6 +45578,7 @@ const holdQuitForSessionCookieSnapshot = createSessionCookieQuitHold({
 });
 electron.app.on("before-quit", async (event) => {
   quitState.begin();
+  quitExitDeadline.arm("before the session-cookie hold");
   electron.globalShortcut.unregisterAll();
   miniViewRegistrar?.dispose();
   quickSendWatcher?.stop();
@@ -45233,6 +45588,7 @@ electron.app.on("before-quit", async (event) => {
     armHeadlessExitDeadline("the app is quitting");
   }
   if (await holdQuitForSessionCookieSnapshot(event)) return;
+  quitExitDeadline.phase("after the session-cookie hold");
   logger.info("App is about to quit", LogFileType.BACKEND);
   if (!backendService.isOwnedCleanupComplete()) {
     try {
@@ -45253,6 +45609,7 @@ electron.app.on("before-quit", async (event) => {
   }
   activeUpdateService?.quitForInFlightInstall("app quit");
   void stopBrowserHost();
+  quitExitDeadline.phase("awaiting the window close");
 });
 process.on("exit", () => {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-operator-ui",
-  "version": "0.34.11",
+  "version": "0.34.12",
   "productName": "Local Operator",
   "description": "User interface for AI agent assistants that run Python code safely on your device through an intuitive chat interface. Supports local and cloud LLM models with built-in security features.",
   "main": "./out/main/index.js",